This is not a memory issue as we have enough and there is no load on the servers currently.

The latest firmware, drivers and updates have been applied.

Backups run at 18:00 everyday and normally finish before 19:00.

We have excluded all the required files and folders as specified in the Mcafee documentation, we have also added the required exchange processes to the Low-Risk policy and excluded from scanning as per the documentation.

With all the above done, the issue keeps happening.

If we disable Mcafee Access Protection, On-Access Scanner and the Framework service the problem goes away, so this appears to be an issue with Mcafee.

Re: Exchange 2013 and Virussscan 8.8 patch 5 - Event ID 906 issues

That particular setting requires a reboot to be cleared from memory, unfortunately. Once it is on, it cannot simply be turned off. Though disabling it in policy is necessary of course, but it takes a reboot to make the change stick.